Vice President Marketing

BigCommerce data breach: customer data exposed via third-party app vulnerabilities. Post Views: 20 BigCommerce has informed multiple merchants of a security incident involving unauthorized access to customer data via compromised credentials for third-party applications. Overview of the breach. BigCommerce has informed multiple merchants of a security incident involving unauthorized access to customer data via compromised credentials for third-party applications. Attackers exploited these credentials to inject malicious code into online stores, potentially compromising sensitive information. The breach occurred between September 13 and September 17, during which unauthorized parties accessed shopper data within BigCommerce environments. Timeline of the incident. The breach occurred between September 13 and September 17, during which unauthorized parties accessed shopper data within BigCommerce environments. BigCommerce confirmed the breach on September 17 and took immediate action to remove the compromised applications from its platform. Affected merchants. Affected merchants, including UK-based online spirits retailer Master of Malt, reported that customer details such as full names, addresses, phone numbers, and shipping postal codes may have been exposed. The incident specifically targeted third-party applications operating within the BigCommerce ecosystem rather than the platform itself. Compromised application key. A compromised application key associated with Ribon, a third-party tool managed by Be A Part Of, was identified as a critical factor in the breach. BigCommerce supports over 1,200 third-party applications, including Ribon, which focuses on enhancing shopping experiences. Platform security measures. BigCommerce clarified that account passwords and payment card information were stored separately and remained unaffected. The company emphasized that its core systems and the BigCommerce platform itself were not breached. However, attackers reportedly used the stolen application key to access existing customer records through the platform. Aftermath and response. Master of Malt reported the incident to the UK Information Commissioner's Office and initiated an investigation into potential impacts on its customers and other connected stores. The breach also prompted legal firms like Emery Reddy to seek potential claimants, as affected retailers notified customers of data exposure linked to the Ribon application key theft. Similar past incidents. This incident bears similarities to a 2024 breach involving electronics accessories provider ZAGG, where attackers exploited a third-party application called FreshClick to inject payment-skimming code. In both cases, the attack vector relied on compromised third-party access rather than direct breaches of the e-commerce platform. Risks of third-party integrations. The event underscores the risks associated with integrating third-party applications into online stores. Even if the primary platform remains secure, stolen credentials for external tools can provide attackers with access to merchant environments and customer data. BigCommerce stated it had removed the affected applications following detection of unauthorized activity. Recommendations for merchants. The breach highlights the importance of monitoring third-party integrations and implementing strict access controls. Organizations are advised to review their application ecosystems, verify credential security, and ensure compliance with data protection regulations. "Master of Malt reported the incident to the UK Information Commissioner's Office and initiated an investigation into potential impacts on its customers and other connected stores." Conclusion. This breach serves as a critical reminder of the vulnerabilities introduced by third-party integrations. While BigCommerce acted swiftly, the incident emphasizes the need for continuous vigilance in securing external tools and data access points.

BigCommerce merchants suffer data breach via Ribon app Key theft. September 21, 2026 - By CyberNewsAI Admin - VERIFIED INTEL SOC briefing summary:: executive Key takeaways. * [01]Threat summary: BigCommerce warned merchants that attackers compromised third-party Ribon app keys to access customer records across multiple online stores. * [02]Root cause vector: Stolen OAuth/API application keys held by developer Fastr (Be A Part Of) permitted unauthorized BigCommerce API queries and storefront script injection. * [03]Immediate action: Audit installed third-party apps, revoke and regenerate all e-commerce API keys, and enforce Content Security Policies (CSP) against unauthorized scripts. Executive summary. Leading Software-as-a-Service (SaaS) e-commerce provider BigCommerce has issued urgent notifications to online retailers following a third-party supply chain breach that exposed customer records and triggered malicious script injections across active storefronts. According to security advisories and merchant disclosures, attackers compromised API access credentials for Ribon and Ribon 1.5 - popular store-optimization applications operated by Be A Part Of, a subsidiary of digital commerce provider Fastr. The unauthorized activity commenced on September 13, 2026, when adversaries leveraged the compromised BigCommerce Application Keys to initiate unauthorized REST API requests into merchant environments. The intrusion persisted undetected until September 17, 2026, when BigCommerce security teams identified anomalous behavior, forcefully revoked the compromised credentials, and remotely uninstalled the Ribon applications across all affected merchant stores. High-profile merchants, including UK-based online spirits retailer Master of Malt, have reported the security incident to the UK Information Commissioner's Office (ICO). Compromised customer records include full names, email addresses, phone numbers, and physical shipping addresses. BigCommerce stressed that its core platform infrastructure and primary databases remained unbreached, and that account passwords and payment card information (PCI) are stored in isolated cryptographic environments that were not accessed during the incident. Technical vulnerability Analysis & attack chain. The breach underscores the severe systemic risks inherent in modern e-commerce SaaS application ecosystems, where third-party marketplace integrations frequently hold expansive API access to merchant environments: [Adversary Infiltrates Developer Environment (Be A Part Of / Fastr)] [Theft of Long-Lived BigCommerce Application OAuth / API Keys] - Keys for 'Ribon' and 'Ribon 1.5' Shopping Optimization Apps Compromised - Keys Contained Delegated Merchant Store Scopes [Automated API Reconnaissance & Data Harvesting (Sep 13 - Sep 17)] - Adversary Initiates Direct REST API Calls to BigCommerce Merchant Tenants - Queries Orders, Customers, and Shipping Endpoints: GET /api/v2/customers GET /api/v2/orders - Exfiltrates Names, Email Addresses, Phone Numbers & Physical Delivery Addresses [Storefront Script Injection & DOM Tampering Attempt] - Leverages App Script Manager Permissions (POST /v3/content/scripts) - Potential Magecart / Skimming Vector Prior to Revocation [Incident Discovery & Containment (September 17, 2026)] - BigCommerce Security Detects Anomalous API Consumption Patterns - Global Force-Uninstall of Ribon / Ribon 1.5 Across Merchant Ecosystem - Revocation of Compromised Developer OAuth Tokens 1. The anatomy of third-party SaaS application Key theft. BigCommerce supports more than 1,200 third-party applications in its ecosystem. Under the standard OAuth 2.0 authorization framework used by BigCommerce, merchants grant third-party applications granular or broad permissions (e.g., Manage Customers, Manage Orders, Manage Store Content) when installing an app from the marketplace. The threat actors gained access to the proprietary developer keys for Ribon and Ribon 1.5 directly from the developer's infrastructure (Be A Part Of / Fastr). Armed with these authentic application credentials, the attackers did not need to exploit any software zero-days or breach BigCommerce's central cloud infrastructure: * API Impersonation: The stolen keys allowed the attackers to forge authenticated requests as the legitimate Ribon service. * Multi-Tenant Infiltration: Because the compromised application was installed across hundreds of commercial storefronts, the adversary gained delegated access to all merchant tenants where Ribon held active permissions. 2. Shopper record exfiltration via REST API. Between September 13 and September 17, 2026, the attackers systematically queried BigCommerce store management APIs. Utilizing endpoints such as /v2/customers and /v2/orders, they extracted database records encompassing: * Full customer legal names * Primary contact email addresses * Verified phone numbers * Physical delivery and shipping addresses BigCommerce isolates authentication databases (salted and hashed passwords) and payment processing components (PCI-DSS tokenized card processing pipelines). Because payment cards are handled via hosted payment gateways or direct processor integrations, the API calls pulled only customer shipping and contact metadata. 3. Client-Side Script Injection threats. In addition to API exfiltration, BigCommerce confirmed that the stolen credentials were used to inject malicious scripts into a subset of merchant storefronts. E-commerce applications often retain permissions to utilize BigCommerce's Script Manager API (/v3/content/scripts) to insert tracking pixels, chat widgets, and UX optimizers into store HTML. By abusing these legitimate permissions, adversaries attempted client-side DOM tampering - a classic technique utilized by e-skimming and Magecart syndicates to capture credentials or manipulate client browsers. Prompt intervention by BigCommerce on September 17 purged the application and detached the injected scripts before widespread payment harvesting occurred. Threat Actor profile & Campaign attribution. * Campaign Parallels (The 2024 ZAGG FreshClick Incident): This attack closely mirrors the 2024 breach of mobile accessory giant ZAGG, where threat actors compromised the third-party FreshClick BigCommerce app to inject payment-skimming code directly into checkout pages. In both instances, attackers targeted trusted marketplace developers rather than attempting direct attacks against hardened e-commerce cloud providers. * Threat Actor Tradecraft: The adversary demonstrated operational familiarity with e-commerce SaaS architecture, targeting high-privilege marketplace developers to achieve massive downstream blast radius. The exfiltrated personal identity data is prime fuel for targeted phishing, credential stuffing, and executive spear-phishing campaigns. * Affected Demographics: While UK spirits vendor Master of Malt was among the first to alert consumers, legal notices indicate that dozens to hundreds of global merchants utilizing Ribon tools may be impacted across North America and Europe. Detection & SOC mitigation playbook. 1. Patch & workaround guidance. * Audit and Purge Compromised Applications: * Log into the BigCommerce Control Panel and navigate to Apps -> Manage My Apps. * Verify that Ribon and Ribon 1.5 are uninstalled. * Review all remaining third-party apps for unnecessary permissions, particularly those with access to customer lists or storefront script injection capabilities. * Credential & API Key Rotation: * Immediately rotate all BigCommerce Store-Level API accounts, webhooks, and private API tokens generated for external services. * Revoke and re-issue any API secrets shared across multiple integration platforms. 2. Network & perimeter defenses. * Implement Strict Content Security Policy (CSP): * Enforce restrictive Content-Security-Policy headers on all e-commerce storefronts to prevent unauthorized external scripts from executing or exfiltrating data: Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.bigcommerce.com https://*.trustedpayments.com; connect-src 'self' https://api.bigcommerce.com; object-src 'none'; * Enable Subresource Integrity (SRI): * For all scripts loaded from external CDNs, mandate Subresource Integrity hashes to block tampered script execution in customer browsers. 3. Endpoint detection & hunting query. BigCommerce API Audit query: Detecting high-volume customer endpoint pulls. - BigCommerce Access Log Analysis: Detecting automated customer data scraping timestamp, client_ip, request_method, request_uri, http_status, user_agent, oauth_client_id, response_size_bytes FROM bigcommerce_api_access_logs WHERE request_uri LIKE '%/v2/customers%' OR request_uri LIKE '%/v2/orders%' AND timestamp BETWEEN '2026-09-13T00:00:00Z' AND '2026-09-17T23:59:59Z' AND (response_size_bytes > 50000 OR http_status = 200) ORDER BY response_size_bytes DESC; Splunk hunting query: outbound storefront script callouts to unrecognized endpoints. index=web_proxy sourcetype=squid_access | search uri_path="*/checkout*" OR uri_path="*/cart*" | eval domain=replace(dest_host, "^[^.]*.", "") | where NOT (domain IN ("bigcommerce.com", "paypal.com", "stripe.com", "google-analytics.com", "fastly.net")) | stats count earliest(_time) as first_seen latest(_time) as last_seen values(uri) by src_ip, dest_host | sort - count Indicators of Compromise (IOCs) 6 Identified // verified_sources_&_references. OPERATIONS_BROADCAST Watch full video briefings on youtube.

BigCommerce alerts merchants of data breach linked to Ribon apps. * September 21, 2026 * 05:18 PM * 0 Ecommerce platform BigCommerce has alerted multiple merchants to data breaches after attackers compromised credentials for third-party Ribon applications and used them to inject malicious scripts into online stores. The cloud-based Software-as-a-Service (SaaS) ecommerce platform confirmed the credential compromise on September 17 and immediately removed the apps to protect its customers. UK-based online spirits vendor Master of Malt is one of the BigCommerce customers that received the notification. The retailer said the attacker accessed shopper information. The hacker used the compromised credentials to access shopper data in BigCommerce environments between September 13 and September 17, the company said. In updates on the incident, Master of Malt says impacted shopper details include full names, email addresses, phone numbers, and shipping postal addresses. "It looks like hackers were able to compromise a BigCommerce Application key held by Ribon, which they were able to use to gain access to customer data held on their system," Master of Malt stated. BigCommerce supports over 1,200 third-party applications and integrations, including Ribon, an application operated by Be A Part Of, a brand operated by Fastr, specialized in shopping experience optimization. The e-commerce platform says it stores account passwords and payment card information separately and that this type of data was not exposed. In a statement for BleepingComputer, BigCommerce said that the attacker compromised credentials for Ribon and Ribon 1.5 applications. "On September 17, 2026, Commerce confirmed that credentials belonging to third-party applications Ribon and Ribon 1.5, owned and operated by 'Be A Part Of,' a Fastr company, had been compromised and used to inject malicious scripts into a small number of merchant storefronts." The company underlined that its systems or the BigCommerce platform were not breached. "Acting in the best interest of our customers and their shoppers, we uninstalled the application from affected stores to revoke the attacker's access, notified those merchants directly, and are providing log data to support the developer's investigation," the company told BleepingComputer. Master of Malt reported the incident to the UK Information Commissioner's Office (ICO) and noted that it may extend well beyond its own customers, potentially to hundreds of other stores. Law firm Emery Reddy is seeking potential claimants linked to the incident, saying several retailers are currently notifying customers about data exposure linked to the Ribon app key theft, without naming any. BleepingComputer has contacted Be A Part Of and Fastr for more information about the incident but Bleeping Computer, LLC has not received a response by publication time. The incident is similar to a 2024 breach affecting electronics accessory maker ZAGG, where attackers compromised the third-party FreshClick BigCommerce app and injected payment-skimming code into its online store. At the time, BigCommerce told BleepingComputer that its platform was not breached and removed the compromised app from customers' stores. However, unlike the ZAGG incident, where attackers captured payment information entered by customers during checkout, the Ribon attackers used a compromised application key to access existing customer records through BigCommerce. Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.